# Art. 30(5) Exemption Assessment — Helix Biotech Diagnostics S.A.S.

**Organisation**: Helix Biotech Diagnostics S.A.S.
**Country**: France
**Employee Count**: 45
**Assessment Date**: 2025-02-10
**Assessed By**: Pierre Laurent, Privacy Lead
**Supervisory Authority**: CNIL

---

## Step 1: Employee Threshold

| Question | Answer |
|----------|--------|
| Does the organisation employ fewer than 250 persons? | Yes (45 employees) |
| Count includes: full-time, part-time, fixed-term, interns? | Yes |
| Count excludes: independent contractors? | Yes |
| **Threshold met?** | **Yes — proceed to exception assessment** |

---

## Step 2: Processing Activity Inventory

| # | Processing Activity | Data Subjects | Frequency | Special Category? |
|---|---------------------|---------------|-----------|-------------------|
| 1 | Employee payroll | Employees | Monthly | No |
| 2 | Employee HR records | Employees | Ongoing | Yes (sick leave = health) |
| 3 | Diagnostic customer management | Patients | Daily | Yes (health data) |
| 4 | Supplier management | Supplier contacts | Weekly | No |
| 5 | Website contact form | Website visitors | Daily | No |
| 6 | Office relocation assessment | Employees | One-time | No |

---

## Step 3: Per-Activity Exception Assessment

### Activity 1: Employee Payroll

| Condition | Met? | Reasoning |
|-----------|------|-----------|
| C1: Risk to rights | Yes | Financial data (salary, bank account) — risk of financial harm if compromised |
| C2: Not occasional | Yes | Monthly recurring processing |
| C3: Special category | No | No Art. 9(1) or Art. 10 data |
| **Exempt?** | **No** | Conditions 1 and 2 met — RoPA required |

### Activity 2: Employee HR Records

| Condition | Met? | Reasoning |
|-----------|------|-----------|
| C1: Risk to rights | Yes | Employment data — risk of discrimination, employment impact |
| C2: Not occasional | Yes | Ongoing, continuous processing |
| C3: Special category | Yes | Sick leave records constitute health data (Art. 9(1)) |
| **Exempt?** | **No** | All three conditions met — RoPA required |

### Activity 3: Diagnostic Customer Management

| Condition | Met? | Reasoning |
|-----------|------|-----------|
| C1: Risk to rights | Yes | Health data — risk of discrimination, insurance impact, stigmatisation |
| C2: Not occasional | Yes | Daily processing, core business activity |
| C3: Special category | Yes | Diagnostic results and medical history are health data (Art. 9(1)) |
| **Exempt?** | **No** | All three conditions met — RoPA required |

### Activity 4: Supplier Management

| Condition | Met? | Reasoning |
|-----------|------|-----------|
| C1: Risk to rights | Yes | Bank account data — financial risk |
| C2: Not occasional | Yes | Weekly, ongoing business operation |
| C3: Special category | No | No Art. 9(1) or Art. 10 data |
| **Exempt?** | **No** | Conditions 1 and 2 met — RoPA required |

### Activity 5: Website Contact Form

| Condition | Met? | Reasoning |
|-----------|------|-----------|
| C1: Risk to rights | Marginal | Basic contact details — limited risk |
| C2: Not occasional | Yes | Daily submissions, ongoing |
| C3: Special category | No | No Art. 9(1) or Art. 10 data |
| **Exempt?** | **No** | Condition 2 met (and arguably Condition 1) — RoPA required |

### Activity 6: Office Relocation Assessment

| Condition | Met? | Reasoning |
|-----------|------|-----------|
| C1: Risk to rights | Low | Home addresses only, limited risk |
| C2: Not occasional | No | Genuinely one-time exercise |
| C3: Special category | No | No Art. 9(1) or Art. 10 data |
| **Exempt?** | **Potentially yes** | No conditions clearly met — but recommend documenting anyway |

---

## Step 4: Overall Determination

| Metric | Value |
|--------|-------|
| Total activities assessed | 6 |
| Activities NOT qualifying for exemption | 5 |
| Activities potentially qualifying | 1 |
| **Overall exemption available?** | **No** |

---

## Step 5: Decision and Recommendation

**Decision**: Helix Biotech Diagnostics S.A.S. must maintain a RoPA despite having fewer than 250 employees, because:

1. The organisation processes special category data (health data in diagnostic services and employee sick leave), meeting Exception Condition 3.
2. All core processing activities are non-occasional (monthly, weekly, daily, ongoing), meeting Exception Condition 2.
3. Processing of financial and health data creates risk to data subjects' rights, meeting Exception Condition 1.

**Recommendation**: Maintain a complete RoPA for all processing activities using the CNIL simplified template for small organisations. The one activity that might technically qualify for exemption (office relocation) should also be documented for accountability purposes and minimal additional effort.

---

## Approval

| Role | Name | Date | Signature |
|------|------|------|-----------|
| Assessor | Pierre Laurent | 2025-02-10 | P. Laurent |
| DPO | Dr. Elena Voss | 2025-02-12 | E. Voss |
| Managing Director | Jean-Marc Dupont | 2025-02-14 | J-M. Dupont |

---

*This assessment should be retained as evidence of accountability under Art. 5(2). Reassess if employee count approaches 250 or if processing activities change significantly.*